Detecting LAUNDRY BEAR: Zimbra CVE-2025-66376 XSS and Email Harvesting

The NCSC and allied agencies published advisory AA26-204A on July 23, naming LAUNDRY BEAR as a Russian state-supported threat actor exploiting CVE-2025-66376, a stored XSS flaw in Zimbra Collaboration Suite, to harvest up to 90 days of email from targeted accounts without any victim interaction. The group deploys a custom tool called Ulej through the XSS vector to extract email content, Global Address List entries, and authentication tokens.

This is not a phishing campaign in the traditional sense. The exploit is triggered when a victim previews or opens a crafted email in the Zimbra webmail interface. There is no link to click and no attachment to execute. Detection must focus on server-side indicators: XSS payload delivery via email, anomalous Zimbra API access patterns, and authentication token theft.

MITRE ATT&CK Mapping

Detection Surface 1: Zimbra Access Log Anomalies

Ulej’s collection behaviour produces detectable patterns in Zimbra access logs. The tool makes bulk authenticated requests to Zimbra’s SOAP API to retrieve mail items — specifically the SearchRequest and GetItemRequest SOAP methods — across date ranges. A legitimate user might perform occasional searches; Ulej issues dozens or hundreds of paginated retrieval requests in rapid succession.

Zimbra logs these in /opt/zimbra/log/access.log with the authenticated account name, source IP, and SOAP action. Look for:

• Repeated SearchRequest calls with dateRange parameters spanning months, from a single authenticated session
• Sequential GetItemRequest calls at intervals under 500ms
• Unusually high message counts in short timeframes from a session that was active in the webmail interface

Sigma Rule — Bulk Zimbra SOAP API Email Retrieval:

title: LAUNDRY BEAR Zimbra Bulk Email Collection via SOAP API
id: b7a2c3f4-9e1d-4a5b-8c7f-2d3e4f5a6b7c
status: experimental
description: Detects bulk email retrieval via Zimbra SOAP API consistent with LAUNDRY BEAR Ulej tooling
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a
  - https://www.ncsc.gov.uk/news/uk-and-partners-expose-russian-state-supported-actors-for-new-zero-click-phishing-campaign
author: SOC Analyst Hub
date: 2026/07/24
tags:
  - attack.collection
  - attack.t1114.002
  - attack.credential_access
  - attack.t1539
logsource:
  category: webserver
  product: zimbra
detection:
  selection:
    cs-uri-stem|contains: '/service/soap'
    cs-method: 'POST'
    cs-uri-query|contains:
      - 'SearchRequest'
      - 'GetItemRequest'
  timeframe: 5m
  condition: selection | count(cs-username) by cs-ip, cs-username > 30
falsepositives:
  - Email migration tools
  - Authorised backup or archiving systems
  - Exchange or IMAP connectors
level: medium

Detection Surface 2: Zimbra Web Access Log — CSS @import XSS Delivery

CVE-2025-66376 exploits insufficient sanitisation of CSS @import directives in email content processed by Zimbra’s webmail renderer. When a malicious email containing the XSS payload reaches a Zimbra server, it is stored and processed. The XSS fires when the target user opens or previews the email in the web client.

Detection on the delivery side is possible via SMTP gateway or email security appliances that inspect email body content. Look for @import directives in email HTML bodies combined with JavaScript-like URL references.

Sigma Rule — CSS @import XSS Pattern in Inbound Email (Web Proxy / Email Gateway):

title: Potential Zimbra CVE-2025-66376 XSS Delivery via CSS @import in Email
id: c8f3d2a1-0b4e-5c6d-9a8b-3e2f1a0b9c8d
status: experimental
description: Detects CSS @import directives in inbound email HTML bodies that may represent CVE-2025-66376 exploitation attempts
author: SOC Analyst Hub
date: 2026/07/24
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.execution
  - attack.t1059.007
logsource:
  category: proxy
  product: generic
detection:
  selection:
    c-uri|contains: '/service/home'
    r-dns|contains: 'zimbra'
    c-uri-query|contains: '@import'
  condition: selection
falsepositives:
  - Legitimate CSS in marketing emails (review in context)
level: low

Detection Surface 3: KQL — Bulk Email Access via Exchange / Microsoft 365 Equivalent

For organisations not running Zimbra but seeking to detect similar email collection behaviour from state-affiliated actors via compromised webmail sessions, the following KQL targets Microsoft 365 unified audit logs:

// Bulk email collection detection — Microsoft 365 Unified Audit Log
// Adapted from LAUNDRY BEAR Ulej-pattern to Exchange Online equivalents
let threshold = 100;
OfficeActivity
| where TimeGenerated > ago(4h)
| where RecordType == "ExchangeItemAggregated"
    and Operation in ("MailItemsAccessed", "Search")
| where ClientInfoString !has "IMAP" and ClientInfoString !has "POP3"
| summarize
    AccessCount = count(),
    UniqueMailboxes = dcount(UserId),
    EarliestAccess = min(TimeGenerated),
    LatestAccess = max(TimeGenerated)
    by UserId, ClientIPAddress, ClientInfoString
| where AccessCount > threshold
| extend DurationMinutes = datetime_diff("minute", LatestAccess, EarliestAccess)
| where DurationMinutes < 30
| project-reorder UserId, ClientIPAddress, AccessCount, DurationMinutes, EarliestAccess, ClientInfoString
| order by AccessCount desc

Detection Surface 4: Authentication Token Theft Indicators

Ulej captures Zimbra authentication tokens from the victim’s session. Post-theft, those tokens may be replayed from an attacker-controlled IP. Detection: look for Zimbra sessions authenticated with a valid token but originating from a source IP inconsistent with the account’s baseline.

Sigma Rule — Zimbra Session Token Replay from Unexpected IP:

title: Zimbra Authentication Token Replay from Anomalous Source IP
id: d9a4e3b2-1c5f-6d7e-0a9b-4f3e2d1c0b9a
status: experimental
description: Detects authenticated Zimbra sessions from source IPs inconsistent with established user patterns, indicating possible session token theft
author: SOC Analyst Hub
date: 2026/07/24
tags:
  - attack.credential_access
  - attack.t1539
  - attack.lateral_movement
logsource:
  category: webserver
  product: zimbra
detection:
  selection:
    sc-status: '200'
    cs-uri-stem|contains: '/service/soap'
  filter_known_ips:
    cs-ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_known_ips
falsepositives:
  - Legitimate remote access and mobile users
  - VPN exit nodes in unexpected geographies
level: medium

Response Actions

If Zimbra exploitation is confirmed or suspected:

1. Immediately apply the Zimbra patch addressing CVE-2025-66376 (available in current releases)
2. Invalidate all active Zimbra sessions and force re-authentication
3. Pull Zimbra SOAP API access logs for the preceding 90 days and analyse for Ulej-pattern bulk retrieval
4. Treat email content from the 90-day window as potentially collected; assess secondary risk from sensitive communications
5. Review authentication logs for token replay from external IP addresses
6. Cross-reference with CISA AA26-204A indicators of compromise for network-level hunting

The advisory recommends enabling MFA on Zimbra and restricting external webmail access to VPN or known IP ranges to reduce the attack surface going forward.